MMCS opens: edge-content and the byte-range circus
After roughly a month of reverse engineering past Lock, on 24 May 2026 I finally put a foot into MMCS—Apple’s content pipeline behind backup assets. That was the day the adventure got oddly fun again: not because it was easy, but because the map changed from CloudKit records to edge-content hosts, ranged GETs, and blobs that refused to be only one kind of thing.
By then I no longer needed the jailbroken iPhone or Elcomsoft as a daily crutch for the next problems. Cursor—and, frankly, older public fragments that pointed at Octagon—let me climb paths EPB never advertised. Elcomsoft stayed on the “normal” restore road. The coding agent made it possible to stare past that road into escrow / Octagon territory that commercial tooling simply did not expose as a research surface.
EPB was not discarded for vanity. I still had to reverse how they cached MMCS responses and how they reassembled decrypted chunks. Even that oracle was incomplete: through the summer IKE and EPB both left files on the table. Side-by-side, my reconstructions often held on the order of ~3000 more decrypted files than theirs, covering nearly the whole available set—yet a stubborn tail of chunks still refused to come out clean until much later.
Foreshadow: the last pocket of failures would later turn on lead bytes
(0x04 vs 0xC4)—see the 4 August
note. May was about opening the MMCS door.
So, 24 May: MMCS and the edge. The same ranged response could carry Ford key material or chunk ciphertext for the same logical file, depending on how you sliced the byte range and how the authorizeGet / container plan had described the host. Getting that wrong meant feeding a decryptor the wrong species of bytes and watching MAC checks lie to you with perfect confidence.
The fileList story—how names, signatures, and ranges bind into a download plan—deserves its own entry. On this date the honest summary is simpler: Lock was behind us; the content edge was ahead; and for the first time the work felt less like begging a commercial GUI and more like reading a protocol that would occupy the rest of the summer.
← All notes